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Abstract 

This work considers the muhiple- access muhicast error-correction scenario over a packetized network with 
z maUcious edge adversaries. The network has min-cut m and packets of length I, and each sink demands all 
O . information from the set of sources S. The capacity region is characterized for both a "side-channel" model (where 
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sources and sinks share some random bits that are secret from the adversary) and an "omniscient" adversarial 
model (where no limitations on the adversary's knowledge are assumed). In the "side-channel" adversarial model, 
the use of a secret channel allows higher rates to be achieved compared to the "omniscient" adversarial model, 
and a polynomial-complexity capacity-achieving code is provided. For the "omniscient" adversarial model, two 
capacity-achieving constructions are given: the first is based on random subspace code design and has complexity 
exponential in ^m, while the second uses a novel multiple-field-extension technique and has 0{lm}^^ ) complexity. 



■ In other words, MANIAC codes. 

» I ' ** The first five authors had equal contribution to this work and they are named in alphabetical order. 
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which is polynomial in the network size. Our code constructions are "end-to-end" in that all nodes except the 
sources and sinks are oblivious to the adversaries and may simply implement predesigned linear network codes 
(random or otherwise). Also, the sources act independently without knowledge of the data from other sources. 

Index Terms 

Double extended field, Gabidulin codes, network error-correction, random linear network coding, subspace 
codes. 

I. Introduction 

Information dissemination can be optimized with the use of network coding. Network coding maximizes 
the network throughput in multicast transmission scenarios For this scenario, it was shown in ^ that 
linear network coding suffices to achieve the max-flow capacity from the source to each receiving node. 
An algebraic framework for linear network coding was presented in [3]. Further, the linear combinations 
employed at network nodes can be randomly selected in a distributed manner; if the coding field size is 
sufficiently large the max-flow capacity is achieved with high probability H. 

However, network coding is vulnerable to malicious attacks from rogue users. Due to the mixing 
operations at internal nodes, the presence of even a small number of adversarial nodes can contaminate 
the majority of packets in a network, preventing sinks from decoding. In particular, an error on even a 
single link might propagate to multiple downstream links via network coding, which might lead to the 
extreme case in which all incoming links at the sink are in error. This is shown in Fig. [H where the 
action of a single malicious node contaminates all incoming links of the sink node due to packet mixing 
at downstream nodes. 

In such a case, network error-correction (introduced in [5|) rather than classical forward error-correction 
(FEC) is required, since the former exploits the fact that the errors at the sinks are correlated, whereas 
the latter assumes independent errors. 

A number of papers e.g. JH, [|71|, jHl have characterized the set of achievable communication rates over 
networks containing hidden malicious jamming and eavesdropping adversaries, and given corresponding 
communication schemes. The latest code constructions (for instance ^ and lIH) have excellent parameters 
- they have low computational complexity, are distributed, and are asymptotically rate-optimal. However, 
in these papers the focus has been on single-source multicast problems, where a single source wishes to 
communicate all its information to all sinks. 
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Fig. 1. Propagation of network errors via network coding. The action of a single malicious node contaminates all incoming links of the 
sink node due to packet mixing at downstream nodes. 

In this work we examine the problem of multiple-access multicast, where multiple sources wish to 
communicate all their information to all sinks. We characterize the optimal rate-region for several variants 
of the multiple-access network error-correction problem and give matching code constructions, which have 
low computational complexity when the number of sources is small. 

We are unaware of any straightforward application of existing single-source network error-correcting 
subspace codes that achieve the optimal rate regions. This is because single-source network error-correcting 
codes such as those of [|9l and [O require the source to judiciously insert redundancy into the transmitted 
codeword; however, in the distributed source case the codewords are constrained by the independence of 
the sources. 

II. Background and related work 

For a single-source single-sink network with min-cut C, the capacity of the network under arbitrary 
errors on up to z links is given by 

R<C-2z (1) 

and can be achieved by a classical end-to-end error-correction code over multiple disjoint paths from source 
to the sink. This result is a direct extension of the Singleton bound (see, e.g., IfTOl ). Since the Singleton 
bound can be achieved by a maximum distance separable code, as for example a Reed-Solomon code, 
such a code also suffices to achieve the capacity in the single-source single-sink case. 

In the network multicast scenario, the situation is more complicated. For the single-source multicast the 
capacity region was shown (|[5l, O, [|7]|) to be the same as Qi, with C now representing the minimum 
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of the min-cuts |l6l. However, unlike single-source single-sink networks, in the case of single-source 
multicast, network error correction is required: network coding is required in general for multicast even 
in the error-free case [1], and with the use of network coding errors in the sink observations become 
dependent and cannot be corrected by end-to-end codes. 

Two flavors of the network error correction problem are often considered. In the coherent case, it is 
assumed that there is centralized knowledge of the network topology and network code. Network error 
correction for this case was first addressed by the work of Cai and Yeung [13, [I6]|, [|7]| for the single 
source scenario by generalizing classical coding theory to the network setting. However, their scheme has 
decoding complexity which is exponential in the network size. 

In the harder non-coherent case, the network topology and/or network code are not known a priori to 
any of the honest parties. In this setting, [|9l, [fTTI provided network error-correcting codes with a design 
and implementation complexity that is only polynomial in the size of network parameters. Reference ifTTI 
introduced an elegant approach where information transmission occurs via the space spanned by the 
received packets/vectors, hence any generating set for the same space is equivalent to the sink [fTTTl . Error- 
correction techniques for this case were proposed in [flTI and (SI in the form of constant dimension and 
rank metric codes, respectively, where the codewords are defined as subspaces of some ambient space. 
These works considered only the single source case. 

For the non-coherent multi-source multicast scenario without errors, the scheme of H achieves any 
point inside the rate-region. An extension of subspace codes to multiple sources, for a non-coherent 
multiple-access channel model without errors, was provided in [fT2|. which gave practical achievable (but 
not rate-optimal) algebraic code constructions, and in [[T3l , which derived the capacity region and gave 
a rate-optimal scheme for two sources. For the multi-source case with errors, [fT4l provided an efficient 
code construction achieving a strict subregion of the capacity region. 

III. Challenges 

In this work we address the capacity region and the corresponding code design for the multiple- source 
multicast communication problem under different adversarial scenarios. The issues which arise in this 
problem are best explained with a simple example for a single sink, which is shown in Fig. [2l Suppose 
that the sources Si and S2 encode their information independently from each other. We can allocate one 
part of the network to carry only information from Si, and another part to carry only information from 
^2. In this case only one source is able to communicate reliably under one link error. However, if coding 



Fig. 2. A simple example to show that in the multiple source case in-network coding is required to achieve the network error correction 
capacity. 

at the middle nodes A'^i and N2 is employed, the two sources are able to share network capacity to send 
redundant information, and each source is able to communicate reliably at capacity 1 under a single link 
error. This shows that in contrast to the single source case, coding across multiple sources is required, so 
that sources can simultaneously use shared network capacity to send redundant information, even for a 
single sink. 

In Section IVIII we show that for the example network in Fig. [2l the capacity region is given by 

Ri < f^Si ~ 22; 

R2 < ms, - 2z (2) 
Ri + R2< ms^,s2 - 22;, 

where for z = 1, 2, rate Ri is the information rate of Si, min-cut m^. is the minimum cut capacity between 
Si and sink T, min-cut ms^,s2 the minimum cut capacity between Si, S2 and T and z is the known 
upper bound on the number of link errors. Hence, similarly to single- source multicast, the capacity region 
of a multi-source multicast network is described by the cut- set bounds. From that perspective, one may 
draw a parallel with point-to-point error-correction. However, for multi-source multicast networks point- 
to-point error-correcting codes do not suffice and a careful network code design is required. For instance, 
the work of lfT4ll . which applies single-source network error-correcting codes for this problem, achieves 
a rate-region that is strictly smaller than the capacity region Q when m^^ + 7^ "^5i,52 lEl- 

IV. Our results 

In this paper we consider a "side-channel" model and an "omniscient" adversarial model. In the former, 
the adversary does not have access to all the information available in the network, for example as in dU, 
lfT6l where the sources share a secret with the sink(s) in advance of the network communication. Let S 
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be the set of sources in the network, s be the number of sources, Ri be the mukicast transmission rate 
from source Si, 1 < i < s, to every sink, and for any non-empty subset S' C S let m^/ be the minimum 
min-cut capacity between any sink and S'. 

In Section |VI] we prove the following theorem: 

Theorem 1. Consider a multiple-source multicast network error-correction problem on network Q-possibly 
with unknown topology-where each source shares a random secret with each of the sinks. For any errors 
on up to z links, the capacity region is given by: 

R^<ms'-z V5' C S. (3) 
and every point in the rate region can be achieved with a polynomial-time code. 

By capacity region we mean the closure of all rate tuples . . . , Rs) for which there is a sequence of 
codes of length £, message sets J7 = {1, . • • , J}} and encoding and decoding functions {f]i}, {4>l} for 
every node i in the network and every sink j, so that for every e > and 6 > there is integer L(e, S) > 
such that for every £ > L{e, 5) we have j log \J'^\ > Ri — e and the probability of decoding error at any 
sink is less than 5 regardless of the message. 

In "omniscient" adversarial model, we do not assume any limitation on the adversary's knowledge, 
i.e. decoding should succeed for arbitrary error values. In Section IVII-AI we derive the multiple-access 
network error-correction capacity for both the coherent and non-coherent case. We show that network 
error-correction coding allows redundant network capacity to be shared among multiple sources, enabling 
the sources to simultaneously communicate reliably at their individual cut-set capacities under adversarial 
errors. Specifically, we prove the following theorem: 

Theorem 2. Consider a multiple-source multicast network error-correction problem on network Q whose 
topology may be unknown. For any errors on up to z links, the capacity region is given by: 

^ Ri< ms' - 2z yS' C S. (4) 

iexis') 

The rate-regions are, perhaps not surprisingly, larger for the side-channel model than for the omniscient 
adversarial model. 

Finally, in Section IVII-Bl we provide computationally efficient distributed schemes for the non-coherent 
case (and therefore for the coherent case too) that are rate-optimal for correction of network errors injected 
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by computationally unbounded adversaries. In particular, our code construction achieves decoding success 
probability at least 1 — |s||£^|/p where p is the size of the finite field Fp over which coding is performed, 
with complexity 0{im}^^), which is polynomial in the network size. 

The remainder of the paper is organized as follows: In Section |V] we formally introduce our problem 
and give some mathematical preliminaries. In Section |VI] we derive the capacity region and construct 
multi-source multicast error-correcting codes for the side-channel model. In Section IVIIl we consider 
two network error-correction schemes for omniscient adversary models which are able to achieve the 
full capacity region in both the coherent and non-coherent case. In particular, we provide a general 
approach based on minimum distance decoding, and then refine it to a practical code construction and 
decoding algorithm which has polynomial complexity (in all parameters except the number of sources). 
Furthermore, our codes are fully distributed in the sense that different sources require no knowledge of 
the data transmitted by their peers, and end-to-end, i.e. all nodes are oblivious to the adversaries present 
in the network and simply implement random linear network coding [[TTl . A remaining bottleneck is that 
while the implementation complexity (in terms of packet-length, field- size, and computational complexity) 
of our codes is polynomial in the size of most network parameters, it increases exponentially with the 
number of sources. Thus, the design of efficient schemes for a large number of sources is still open. 
Portions of this work were presented in [18] and in |fT9l . 

V. Preliminaries 

A. Model 

We consider a delay-free acyclic network Q = (V, £) where V is the set of nodes and £ is the set 
of edges. The capacity of each edge is normalized to be one symbol of the finite field Fp per unit time 
where j9 is a power of a prime. Edges with non-unit capacity are modeled as parallel edges. 

There are two subsets 5, T C V of nodes where S = {61,62, ■ ■ ■ , Ss} is a set of s sources and T is 
a set of sinks within the network. Let i?j be the multicast transmission rate from Si, 1 < i < s, to every 
sink. For any non-empty subset S' C S, let T{S') C {1, 2, . . . , s} be the indices of the source nodes that 
belong to S'. Let m^/ be the minimum min-cut capacity between S' and any sink. For each i, let Q be 
the code used by source i. Let C5/ be the Cartesian product of the individual codes of the sources in S'. 

Within the network there is a computationally unbounded adversary who can observe all the transmis- 
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sions and inject its own packets on up to z linkjl] that may be chosen as a function of his knowledge of 
the network, the message, and the communication scheme. The location of the z adversarial links is fixed 
but unknown to the communicating parties. In case of a side-channel model, there additionally exists a 
random secret shared between all sources and each of the sinks as in [|9l, [|T6l . 

The sources on the other hand do not have any knowledge about each other's transmitted information 
or about the links compromised by the adversary. Their goal is to judiciously add redundancy into their 
transmitted packets so that they can achieve any rate-tuple within the capacity region. 

B. Random. Linear Network Coding 

In this paper, we consider the following well-known distributed random linear coding scheme [fTTl . 

Sources: All sources have incompressible data which they wish to deliver to all the destinations over 
the network. Source Si arranges its data into batches of hi packets and insert these packets into a bi x i 
message matrix Mi over Fp (the packet-length £ is a network design parameter). Each source Si then 
takes independent and uniformly random linear combinations over Fp of the rows of Mj to generate the 
packets transmitted on each outgoing edge. 

Network nodes: Each internal node similarly takes (uniformly) random linear combinations of the 
packets on its incoming edges to generate packets transmitted on its outgoing edges. 

Adversary: The adversarial packets are defined as the difference between the received and transmitted 
packets on each link. They are similarly arranged into a matrix Z of size z x 

Sink: Each sink t E T constructs a B x i matrix Y over Fp by treating the received packets as 
consecutive length-^ row vectors of Y. Since all the operations in the network are linear, each sink has 
an incoming matrix Y that is given by 

Y = TiMi + T2M2 + ... + TsMs + T,Z, (5) 

where T^, 1 < z < s, is the overall transform matrix from Si to t E T and is the overall transform 
matrix from the adversary to sink t eT. 

C. Finite Field Extensions 

In the analysis below denote by F™^" the set of all m x n matrices with elements from Fp. The identity 
matrix with dimension m x m is denoted by J^, and the zero matrix of any dimension is denoted by O. 

'Note that since each transmitted symbol in the network is from a finite field, modifying symbol x to symbol y is equivalent to 
injecting/adding symbol y — x into x. 



The dimension of the zero matrix will be clear from the context stated. For clarity of notation, vectors 
are in bold-face (e.g. A). 

Every finite field Fp, where p can be algebraically extended^ [|20l to a larger finite field F^, where 
q = for any positive integer n. Note that F^ includes ¥p as a subfield; thus any matrix A E F™^^ is 
also a matrix in F^^^. Hence throughout the paper, multiplication of matrices from different fields (one 
from the base field and the other from the extended field) is allowed and is computed over the extended 
field. 

The above extension operation defines a bijective mapping between F™^" and F^"^ as follows: 

• For each A E F^^", the folded version of A is a vector A-^ in F™ given by AaJ where a = 
{ai, . . . , ttn} is a basis of the extension field F^ with respect to Fp. Here we treat the row of A 
as a single element in Fg to obtain the i^'^ element of A-^. 

• For each B E F™, the unfolded version of B is a matrix 5" E F™^". Here we treat the element 
of B as a row in Fp^" to obtain the i"^ row of 5". 



We can also extend these operations to include more general scenarios. Specifically any matrix A E 



¥. 



mxln 
P 



can be written as a concatenation of matrices A = [Ai . . . Ai], where Ai E F^'^^. The folding 
operation is defined as follows: A^ = [A( . . . A{]. Similarly the unfolding operation u can be applied to 
a number of submatrices of a large matrix, e.g., [A( . . . A{]" = [(A()" . . . (AJ)"] = [Ai . . . Ae]. 

In this paper double algebraic extensions are also considered. More precisely let ¥q be an algebraic 
extension from Fg, where Q = = p^^ for any positive integer A^. Table U summarizes the notation of 
the fields considered. 

TABLE I 

Summary of field notations 



Field 


Fp 


F 




Size 


p 


q = p^ 


Q = q- 



Note: Of the three fields Fp, Fg and Fg defined above, two or sometimes all three appear simultaneously 
in the same equation. To avoid confusion, unless otherwise specified, the superscript / for folding is from 
Fp to Fg, and the superscript u for unfolding is from Fg (or Fq) to Fp. 

^Let Fp[a;] be the set of all polynomials over Fp and f(x) G Fp[x] be an irreducible polynomial of degree n. Then Fp[a;]//(a;) defines 
an algebraic extension field Fpn by a homomorphic mapping 1201 . 
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D. Subspace codes 

In [fTTIl an algebraic framework was developed for the non-coherent network scenario in the single- 
source case. The idea behind it is to treat the fixed-length packets as the vector subspaces spanned by 
them. Then what really matters at the decoder is the subspace spanned by the received packets rather than 
the individual packets. 

Let V be the vector space of length-^ vectors over the finite field Fp, representing the set of all possible 
values of packets transmitted and received in the network. Let ViV) denote the set of all subspaces of V. 
A code C consists of a nonempty subset of V{V), where each codeword U G C is a subspace of constant 
dimension. 

Subspace errors are defined as additions of vectors to the transmitted subspace and subspace erasures 
are defined as deletions of vectors from the transmitted subspace. Note that depending on the network 
code rate and network topology, network errors and erasures translate differently to subspace errors and 
erasures. For instance, subject to the position of adversary in the network, one network error can result in 
both dimension addition and deletion (i.e., both subspace error and subspace erasure in our terminology). 
Let p be the number of subspace erasures and let t be the number of subspace errors caused by z network 
errors. 

The subspace metric [fTTTl between two vector spaces f/i, f/2 G ^(^) is defined as 

dsiUi, f/2) = dim(f/i + U2) - dim(f/i n f/2) 

= dim(f/i) + dim(f/2) - 2 dim(f/i n f/2). 

In [fm it shown that the minimum subspace distance decoder can successfully recover the transmitted 
subspace from the received subspace if 

2{p+t)<Dr, 

where is the minimum subspace distance of the code. Note that ds treats insertions and deletions 
of subspaces symmetrically. In [21 J the converse of this statement for the case when information is 
transmitted at the maximum rate was shown. 

In [I22II a different metric on V, namely, the injection metric, was introduced and shown to improve 
upon the subspace distance metric for decoding of non-constant-dimension codes. The injection metric 
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between two vector spaces f/i, f/2 G 'P(y) is defined as 

dj{Ui, U2) = max(dim(f/i), dim(t/2)) - dim(f/i n f/2) 
= dim([/i + f/2) — mm(dim(f/i), dim(f/2)). 

can be interpreted as the number of error packets that an adversary needs to inject in order to transform 
input space Ui into an output space U2. The minimum injection distance decoder is designed to decode 
the received subspace as with as few error injections as possible. Note that for constant-dimensional codes 
ds and dj are related by 

dj{U,,U2) = ^ds{U,,U2). 

E. Gabidulin Codes and Rank Metric Codes 

Gabidulin in [|23l introduced a class of error correcting codes over FjJ"^". Let X G be the information 
vector, G G F™'''^ be the generator matrix, (GX)" G F™''" be the transmitted matrix, Z G F™^" be the 
error matrix, and (GX)" + Z G F^^" be the received matrix. Then decoding is possible if and only if 
rank(Z) < [|J , where d = m — R + 1 is the minimum distance of the code. 

The work of [SJ utilizes the results of [23] to obtain network error-correcting codes with the following 
properties: 

Theorem 3 (Theorem 11 in [8]). Let Z be expressed as Z = Yl,ie[iT] L^Ej, such that: 
, For each i G [1, t], L, G Fp™^^ and G Fp^^^^; 

• For each i G Lj is known a priori by the sink; 

• For each i G [fi + 1, fi + 6], Ej is known a priori by the sink; 

• 2t — fi — 6<d — 1, 

using Gabidulin codes the sink can decode X with at most 0{mn) operations over ¥q. 

When |U = 5 = 0, Theorem [3] reduces to the basic case where the sink has no prior knowledge about 

Z. 

For any matrices Bi G ¥^^^'^ and B2 G F^^^*" the following proposition holds and is a direct 
consequence of Corollary 3 in IfSl: 

Proposition 1. ds{{Bi), {B2)) < 2rank{Bi - B2) 

where (-Bi), {B2) are the row-spaces of matrices Bi,B2 respectively. 
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VI. Side-Channel Model 

The side-channel model is an extension of the random secret model considered in [fT6ll to the case of 
multiple sources. In that model every source shares a uniformly distributed random secret with each of 
the sinks. For each source the "secret" consists of a set of symbols drawn uniformly at random from 
the base field ¥p and the adversary does not have access to these secret symbols. This set of uniformly 
random symbols can be shared between each source and the sinks either before the transmission starts 
or during the transmission through a low capacity channel that is secret from the adversary and cannot 
be attacked by it. Each source has a different secret from all the other sources which makes this scheme 
distributed. 

Proof of Theorem [7} Converse: Let Uj.j = 1, . . . , rij, be the outgoing links of each source Si,i = 
1, . . . ,s. Take any S' C S. We construct the graph Qs' from Q by adding a virtual super source node 
ws', and rii links = 1, . . . , nj, from ws' to source Si for each i E X(iS'). Note that the minimum cut 
capacity between ws' and any sink is at least m^/. Any network code that multicasts rate Ri from each 

source Si,i E X(iS') over Q corresponds to a network code that multicasts rate Ri from ws' to all 

ieiiS') 

sinks over Q^r, the symbol on each link I'^j is the same as that on link li j, and the coding operations at 
all other nodes are identical for Q and Qs'- For the case of a single source, the adversary can choose the 
z links on the min-cut and set their outputs equal to zero. Therefore in this case the maximum possible 
achievable rate R is 

R<C-z (6) 

where C is the multicast min-cut capacity of the network. The converse follows from applying inequality 
© to ws' for each S' CS. ■ 
Achievability: In the case of the side-channel model, for notational convenience, we will restrict 
ourselves to the analysis of the situation where there are only two sources Si,S2 E V transmitting 
information to one sink t eV, since the extension of our result to more sources and sinks is straightforward 
and analyzed briefly in Section IVIIII 

Encoding: Source Si encodes its data into matrix Xi E Fjf^^*^^"") of size Ri x (i — a), where a = 
52 ~^ ^^'•^ symbols from Fp and arranges its message into Mi = Li Xi where Li E Fjf^^^" is 
a matrix that will be defined below. Similarly, source ^2 arranges its data into matrix M2 = L2 X2 
where L2 E F^^^xa defined below and Xo E F„^2X 
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The shared secret between source Si and sink t is composed of a length-a vector Wi 



Wii 



Wi. 



E Fp^° and a matrix Hi E ¥^^^", where the elements of both Wi and Hi are drawn 
uniformly at random from Fp. The vector Wi defines a parity-check matrix Pi E Fp^" whose (m, r;,)-th 
entry equals i.e., the element Win taken to the m}^ power. The matrix Lj is defined so that the 

following equality holds 



Hi = MiP, 



Li Xi 



Vi 



P, 



LiVi + XiPi 



(7) 



where Vi, Pi correspond to rows {1, . . . , a} and {a + 1, 



of matrix Pi respectively. Matrix Vi E 



F' 



is a Vandermonde matrix and is invertible whenever vector Wi contains pairwise different non-zero 



elements from Fp, else Wi is non-invertible which happens with probability at most a'^/p (each of the 
elements Wij is zero or identical to another element with probability at most a/p). Whenever the matrix 
Vi is invertible source Si solves equation (|7]) to find Lj and substitutes it into matrix Mj. When the matrix 
V is non-invertible then L, is substituted with the zero matrix. 



Linear Coding: Once matrices Mi, M2 are formed then both sources and the internal nodes perform 
random linear network coding operations and therefore sink t gets 



Y = TiMi + T2M2 + T,Z 
Ml 



Ti T2 



(8) 



where Ti E Fp™'Si>'S2 x-^^ and T, E ¥^^^^^2^^ 



Decoding: Assume that matrix Y E W-^^i-^^^ has column rank equal to r and matrix Y^ E Wp^i^^^^"^ 
contains r linearly independent columns of Y. Since all the columns of Y can be written as linear 
combinations of columns of F"*, then Y = Y'^F where F E Fp^^. The columns of Mi, M2 and Z 
corresponding to those in y are denoted as Aff E ¥^^^^, M| E ¥^^^^' and Z'^ E F/^*" respectively. 
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Therefore 



Ml 



Ti T2 T, 



Ml 



(9) 



and by using equations ([8]), ^ we have 



Y = Y'F- 



Ti T2 T, 



Ml 



Mo 



Ti Ta T, 



Mf 



Ml 



Ti T2 



is invertible with 



Therefore Mi = Mf F and M2 = M|F since for large enough p, matrix 
high probability lIH. Consequently, equation ([7]) can be written as (FPi) = Hi where matrices F, Pi 
and Hi are known and matrix is unknown and can be found using standard Gaussian elimination. 

As in im it can be proved that the solution obtained by the Gaussian elimination is with high probability 
the unique solution to equation Mi Pi = Hi. Indeed, using Claim 5 of @, for any 7^ M* the probability 
(over wii, . . . , W7ia) that Mf{FPi) = Hi is at most . Since there are p^^ ''' different matrices Mi 
(Ml = MfF and Mf G F/^^^) by taking the union bound over all different Mi (Corollary 6 in [9]) 
we conclude that the probability of having more than one solution for equation Mi Pi = Hi is at most 
pRi-Tnsj^,s2 < il_ Decoding of X2 is similar. 

Probability of error analysis: In order for the decoding to fail one or more of the following three events 
should occur: 



1) At least one of the network transform matrices 

to ini 



Ti T2 



is not full column rank. According 



171 . this happens with probability less than j where \£\, \T\ is the number of edges 



and the number of sinks in the network. Term 



is the number of different sets of z links the 



£"1 

adversary can attack and is an upper bound for the probability that matrix 
full column rank when the adversary has attacked a specific set of links. 



Ti T2 T, 



IS not 
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2) Either of the Vandermonde matrices Vi or V2 are not invertible. By using the union bound this 
happens with probability at most 2c? j-p. 

3) There are more than one solutions for equations MfiFPi) = Hi for i G {1,2}. This happens with 
probability at most 2r/p = 2£^™si.s2+i)/P- 

ence, it is not difficult to see that the probability of decoding failure can be made arbitrarily small as 
the size p of the finite field increases. Moreover increasing i without bound we can approach any point 
inside the rate-region. The decoding complexity of the algorithm is dominated by the complexity of the 
Gaussian elimination that is 0(£m|^ ^J. 

VII. Omniscient Adversarial Model 

A. General approach 

In this section we construct capacity-achieving codes for the multiple-source multicast non-coherent 
network scenario. We use the algebraic framework of subspace codes developed in [11 J, which provides 
a useful tool for network error and erasure correction over general unknown networks. In Section IV-Dl 
we gave basic concepts and definitions of subspace network codes needed for further discussion. 

In the proof of Theorem [2] we show how to design non-coherent network codes that achieve upper 
bounds given by dH) when a minimum (or bounded) injection distance decoder is used at the sink nodes. 
Our code construction uses random linear network coding at intermediate nodes, single-source network 
error-correction capacity-achieving codes at each source, and an overall global coding vector. Our choice 
of decoder relies on the observation that subspace erasures are not arbitrarily chosen by the adversary, 
but also depend on the network code. Since, as we show below, with high probability in a random linear 
network code, subspace erasures do not cause confusion between transmitted codewords, the decoder 
focuses on the discrepancy between the sent and the received codewords caused by subspace errors. 
The error analysis shows that injection distance decoding succeeds with high probability over the random 
network code. On the other hand, the subspace minimum distance of the code is insufficient to account for 
the total number of subspace errors and erasures that can occur. This is in contrast to constant dimension 
single-source codes, where subspace distance decoding is equivalent to injection distance decoding [i22l . 

Proof of Theorem ^ Converse: The proof is similar to the converse of the proof of Theorem [T] with 
the exception that after connecting any subset of sources 5' C 5 by a virtual super-source node ws', we 
apply the network Singleton bound O to ws' for each S' S. 

^From the three probabihty events the third one dominates the other two when packet size is large. 
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Achiev ability: 1) Code construction: Consider any rate vector . . . ,Rs) such that 

^ Ri< ms' - 2z MS' C S. (10) 

i&X{S') 

Let each Cj, z = 1, . . . , s be a code consisting of codewords that are A;— dimensional linear subspaces. The 
codeword transmitted by source Si is spanned by the packets transmitted by Si. From the single source 
case, for each source i = 1, . . . , s we can construct a code Cj where 

ki>Ri + z (11) 

that corrects any z additions |l9l. This implies that by [|2T1l . Ci has minimum subspace distance greater 
than 2z, i.e. for any pair of distinct codewords Vi, V- G Ci 

ds{Vi, V-) = dim(Vi) + dim{V-) - 2 dim{Vi n V-) > 2z. 

Hence, 

dim{V,nV:) <h-z V\/„V;'eC,. (12) 

By (fTTI) . we have: 

jGX(5') je2(5') 

Therefore, by combining it with (flOl ) and scaling all source rates and link capacities by a sufficiently large 
integer if necessary, we can assume without loss of generality that we can choose ki satisfying 

^ fci < ms' + {\S'\ - 2)z yS' C S. (13) 

iexis') 

We can make vectors from one source linearly independent of vectors from all other sources by 

prepending a length-( hi) global encoding vector, where the jth global encoding vector, j = 

ieiis) 

1,2, . . . ,J2i(zx{s) '-^^ ^^^^ vector with a single nonzero entry in the jth position. This adds an 

overhead that becomes asymptotically negligible as packet length grows. This ensures that 



dim{Vi n Vj) = Vz 7^ j, Vi. e Q, Vj G Cj. 



(14) 
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Error analysis: Let X e C5 be the sent codeword, and let R be the subspace received at a sink. Consider 
any S' C S. Let 'S' = S\S' .1.^ X = V ®W , where V eCs'^W e C^' and \^ is spanned by the codeword 
Vi from each code Cj, i e We will show that with high probability over the random network code, 

there does not exist another codeword Y — V ® W, such that V is spanned by a codeword V- ^ Vi 
from each code Ci,i E 1{S'), which could also have produced R under arbitrary errors on up to z links 
in the network. 

Fix any sink t. Let TZ be the set of packets (vectors) received by t, i.e. it! is the subspace spanned by 
TZ. Each of the packets in 7?. is a linear combination of vectors from V and W and error vectors, and can 
be expressed as p = Up + Wp, where Wp is in W and the global encoding vector of Up has zero entries 
in the positions corresponding to sources in set 1{S'). 

The key idea behind our error analysis is to show that with high probability subspace deletions do not 
cause confusion, and that more than z additions are needed for X be decoded wrongly at the sink, i.e we 
will show that 

di{R, V' ®W) = dim(i?) - dim(i? n {V ® W)) > z. 



Let P — spanjup : p e Tt}. Let M be the matrix whose rows are the vectors p e TZ, where the jth 
row of M corresponds to the jth vector p e TZ. Similarly, let M-a be the matrix whose jth row is the 
vector Up corresponding to the jth vector p e 7Z, and let be the matrix whose jth row is the vector 
Wp corresponding to the jth vector p e 7^. Consider matrices A, B such that the rows of AM^ form a 
basis for P OV and, together with the rows of BM-a, form a basis for P. The linear independence of 



the rows of 



AM^ 
BM„ 



implies that the rows of 



there would be a nonzero matrix D such that 



AM 
BM 



are also linearly independent, since otherwise 



D 



AM 
BM 



D 



AMy, 
BM^ 



= 0, 



a contradiction. For Wp in W, Up + Wp is in V' ®W only if Up is in V', because the former implies 
Up = Up + Wp — Wp is inV'oW and since Up has zero entries in the positions of the global encoding 
vector corresponding to T{S') it must be in V. Thus, since any vector in the row space of -BMu is not in 
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V, any vector in the row space of BM is not in V © W. Since the row space of BM is a subspace of 
R, it follows that the number of rows of B is equal to dim(P) — dim(P fl V) and is less than or equal 
to dim(i?) - dim(i? n{V' ®W)). Therefore, 

di{R, V'®W) = dim(P) - dim(i? n {V © W)) (15) 
> dim(P) -dim(Pnr')• 
We next show that for random linear coding in a sufficiently large field, with high probability 

dim(P) - dim(P nV) > z (16) 

for all V spanned by a codeword V/ ^ Vi from each code Ci,i E X(5'). 

Consider first the network with each source i in S' transmitting ki linearly independent packets from 
Vi, sources in S' silent, and no errors. From the maxflow-mincut bound, any rate vector {hi, ... , /i|5'|), 
such that 

ie5" 

can be achieved. Combining this with (fT3l) . we can see that in the error-free case, each Sj G S' can 
transmit information to the sink at rate ki — for a total rate of 

J2 h-{\S'\~2)z. (17) 

i€X{S') 

With sources in S' still silent, consider the addition of z unit-rate sources corresponding to the error links. 
The space spanned by the received packets corresponds to P. Consider any V spanned by a codeword 
V! Vi from each code % G T{S'). 

Let Z be the space spanned by the error packets, and let 2;' < 2 be the minimum cut between the error 
sources and the sink. Let P = Py © P^, where P^ = P fl Z and Py is a subspace of V . There exists a 
routing solution, which we distinguish by adding tildes in our notation, such that dim Pz = z' and, from 
([n]), dimP> ki - {\S'\-2)z, so 

dim(Py) > J2 h-{\S'\-2)z-z'. (18) 

iGX{5') 
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Note that, by (fT4l) . a packet from Vi is not in any Vj E Cj,j ^ i, and hence is in V if and only if it is 
in y/. Therefore, by ^ 

dim(Py r\V')< J2 (^My^ n Vi') < J2 

Therefore, using (fTSi) we have 

dim(Pv' U V) = dim{Pv) + dim(l^') - dim(Pv' n V) 

> dim(Pv') + dim(l^') + I'^'k - 

ieX(5') 

> J] A;^ - {\S'\-2)z-z' +\S'\z 

= ^ fci + 2z - > fcj + 

iex(<s') jex(5') 

Then 



dim(P UV')> ki + z. 

iex{s') 

For random linear coding in a sufficiently large field, with high probability by its generic nature 

dim(P U V) > dim(P UV) > + ^' 

iex(<s') 

and this also holds for any z or fewer errors, all sinks, and all V spanned by a codeword V- ^ Vi from 
each code Ci,i E X{S'). Then, (fT6l ) follows by 

dim(P) - dim(P n V) = dim(P U V) - dim(r'). 



Hence, using (fT6l) and (fTSl) . 



d/(P, y © py) = dim(P) - dim(P n © W)) 
> dim(P) - dim(P n V) > z. 



Thus, more than z additions are needed to produce R from Y = V (BW. By the generic nature of random 
linear coding, with high probability this holds for any S'. Therefore, at every sink the minimum injection 
distance decoding succeeds with high probability over the random network code. 
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Decoding complexity: Take any achievable rate vector (_Ri, R2, . . . , Rs)- For each i = 1, . . . ,s. Si can 
transmit at mostp^*^ independent symbols. Decoding can be done by exhaustive search, where the decoder 
checks each possible set of codewords to find the one with minimum distance from the observed set of 
packets, therefore, the decoding complexity of the minimum injection distance decoder is upper bounded 

by 0(p'S'=i^O- ■ 

B. Polynomial-time construction 

Similar to the side-channel model, we will describe the code for the case where there are only two 
sources Si,S2 E V transmitting information to one sink t E V, since the extension of our results to 
more sources and sinks is straightforward and analyzed briefly in Section IVIIII To further simplify the 
discussion we show the code construction for rate-tuple (Ri, R2) satisfying _Ri < m^^ —2z, R2 < ms^ —2z, 
Ri + R2 + 2z = ms^^s2 ^iid exactly ms^,s2 edges incident to sink t (if more do, redundant information 
can be discarded). 

Encoding: Each source Si,iE{l, 2}, organizes its information into a matrix Xi E Fj^^^^"^ with elements 
from Fp, where n = Ri + 2z, N = R2 + 2z and k is an integer (and a network parameter). In order to 
correct adversarial errors, redundancy is introduced through the use of Gabidulin codes (see Section IV-EI 
for details). 

More precisely the information of Si can be viewed as a matrix Xi E F^^^^^^^, where is an algebraic 
extension of Fp and q = (see Section IV-CI for details). Before transmission Xi is multiplied with a 
generator matrix, d E ¥g^^^, creating GiXi E Fg"^^^ whose unfolded version M[ = (dXi)" is a 
matrix in Yp^''"'^. The information of S2 can be viewed as a matrix X2 E ¥q^^'', where ¥q is an algebraic 
extension of ¥g where Q = = p^^ . Before transmission X2 is multiplied with a generator matrix, 
G2 E ¥q''^\ creating ^3X2 E ¥^''^ whose unfolded version = (^2X2)" over Fp is a matrix in 
jpAfxfcnAf gQtj^ y^nA G2 are chosen as generator matrices for Gabidulin codes and have the capability 
of correcting errors of rank at most z over Fp and ¥g respectively. 

In the scenario where sink t does not know Ti and T2 a priori the two sources append headers on 
their transmitted packets to convey information about Ti and T2 to the sink. Thus source Si constructs 



message matrix Mi 



In O M[ 



with the zero matrix O having dimensions n x N, and source S2 



constructs a message matnx 



O In M'2 



with the zero matrix O having dimension N x n. Each row 



of matrices Mi, M2 is a packet of length i = knN + n + N. 

Before we continue with the decoding we need to prove the following two Lemmas: 
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Lemma 1. Folding a matrix does not increase its rank. 

Proof: Let matrix H G Fp'"^'=" has rank(i7) = r in field Fp. Thus H = WZ, where Z G F^^'^" is of 
full row rank and W G F™^** is of full column rank. After the folding operation H becomes H'f = W Z^ 
and therefore has rank in the extension field F^, where q = p", is at most r, i.e. rank(H^) < r. ■ 



Lemma 2. Matrix 



TiGi T2 



G F™'Si 'S2^™'Si,s2 is invertible with probability at least 1 — \S\/p. 



Proof: Let X be the set of random variables over Fp comprised of the local coding coefficients used 



is a polynomial f(^) over Fg 



in the random linear network code. Thus the determinant of 
of degree at most \£\ (see Theorem 1 in IfTTl for details). Since the variables X in t{X) are evaluated 
over Fp, t{X) is equivalent to a vector of polynomials (fi(X), f2iX), . . . , fn{X)), where fi{X) G ¥p[X] 
is a polynomial over Fp with variables in X. Note that fi{X) also has degree no more than \£\ for each 
i G {1, . . . , n}. Thus once we prove that there exists an evaluation of X such that f is a nonzero vector 



over Fp, we can show that matrix 



is invertible with probability at least 1 — \£\/p by the 
Schwartz-Zippel lemma II24I (Proposition 98). 

Since Ri + N = m^^ Ri < nis^ and < m^j, there exist Ri + N edge-disjoint- 
pathsiPj"^, ) • • • 7 from Si to t and , P|, . . . , V% from S2 to t. The variables in X are evaluated 
in the following manner: 

1) Let O be the zero matrix in Fg^^ . We choose the variables in X so that the Ri independent rows 



of 



Gi O 



G correspond to routing information from Si to t via Vl, . . . , Pj^^. 

2) Let {u/jj+i, • • • ,^ms^ ^ distinct rows of the identity matrix in W^^i^^2^"^si,s2 such 

that for each i G {1, . . . , A^}, U/j^+j has the element 1 located at position Ri + i. Then these N 
vectors correspond to routing information from ^2 to sink t via 



p2 



Under such evaluations of the variables in X, matrix 



TiGi T2 



equals 



G'l O 



O I 



N 



where G'l G 



■^RixRi consists of the Ri independent rows of Gi. Hence f is non-zero. Using the Schwartz-Zippel 



Lemma f 7^ and thus 
X. 



TiGi T2 



is invertible with probability at least 1 — \£\/p over the choices of 



Decoding: The two message matrices Mi, M2 along with the packets inserted by the adversary are 
transmitted to sink t through the network with the use of random linear network coding (see Section |^B]) 
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and therefore sink t gets: 



Y = TiMi + T2M2 + T,Z 



^ Y 



Yi Y2 Fa 



(19) 



E 



where A = TiM[ + TaM^ G F^^i.saX^"^ and E G Y^/^s^s^x^ has rank no more than z over field Fp. Let 
where Ei G Fp^^i-^a^", E2 G Fp"''Si.'S2x^ and Eg G Fp™^!.^^^'^"^. Sink t will first 

be a matrix in f™si.s2x(«i+^+'=^). To be precise: 



-El E2 E3 
decode A/2 and then Mi. 
Sto^e i/ Decoding X2: Let 



YiGi Y2 y/ 



TiGi T2 A/ 



+ 



Eld ^2 



(20) 



Sink t uses invertible row operations over F^ to transform Ya into a row-reduced echelon matrix 
Trre Mrre that has the same row space as Ya, where Trre has m^^^^^ = Ri + N columns and 
Mrre has kN columns. Then the following propositions are from the result^ proved in 

Ic + LUl r 



Proposition 2. 1) The matrix 



RRE 



M, 



RRE 



takes the form 



RRE 



M, 



RRE 



o 



E 



where G F^^"^^ comprises of fi distinct columns of the C x C identity matrix such that U^r = 



and U^L = —In. In particular, L in WP^^^ is the "error-location matrix", r G F, 



CxkN 



is the 



"message matrix", and E G Wq^''^ is the "known error value" (and its rank is denoted 5). 



2) Let X 



ds 
and 



RRE 



Xi 

M 



and e = r — X and t 



rank 



RRE 



J Y 



L e 
E 

, i.e., the subspace distance between 



Then 2t — fi — 6 is no more than 

Tbre Mure 



3) There exist t column vectors Li, L2, . . . , G F^ and r row vectors Ei, E2, . . . , G F, 
that e = J2ie[i r] L^Ej. In particular, Li, L2, . . . , are the columns of L, and E^+i, E^+2, 
are the rows of E. 



• IxkN 



such 



E 



In the following subscript d stands for the last rows of any matrix/vector. Then we show the following 
for our scheme. 

Lemma 3. 1) Matrix = — M/ can be expressed as = Xliei 2 r (-'-'« where 
(Li)d, (L2)d, . . . , (L^)rf are the columns of Ld and E^^+i, E^+2, • • • , ^^l+s are the rows of E. 

'^l) is from Prop. 7, 2) from Thm. 9, and 3) from Prop. 10 in jS). 
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2) With probability at least 1 — \S\/p, 2t — fi — 6 < 2z 

Proof: 1) It is a direct corollary from the third statement of Proposition [2l 
2) Using the second statement of Proposition [21 it suffices to prove with probability at least 1 — \£\/p. 



d, 



RRE 



M, 



RRE 



< 2z. 



As shown in the proof of Lemma [B the columns of eI are in the column space of (and 



then of E) over F„. Thus 



El E2 E' 



and therefore 



EiGi E2 E- 



over ¥q. Using Proposition □ and ds{{Ya) , ( TiGi T2 



has rank at most equal to 
is no more than 2z. Since 



RRE 



RRE 



{Ya)) 



0, we have d^ 



RRE 



M, 



RRE 



TiGi T2 AS 



< 2z. 



Using Lemma [2l matrix D 



TiGi T2 



has zero subspace distance from 



is invertible with probability at least 1 — \S\/p, so 



D DX 



TiGi T2 Af 



. Thus, 



T, 



RRE MpiRE 



^rns^ ,52 



< 2z. 



In the end combining Lemma[3]and Theorem [3] sink t can take {L^, E, r) as the input for the Gabidulin 
decoding algorithm and decode X2 correctly. 



Stage 2: Decoding Xi: From (fT9l) sink t gets Y 



Ti + Ei T2 + E2 A + E3 



computes (T2 



E2)M2, and then subtracts matrix 



O {T2 + E2) {T2 + E2)M2 



from Y . The resulting matrix has 



zero columns in the middle (column n + 1 to column n + N). Disregarding these we get: 



Y' 



Ti TiMi 



+ 



El 



The new error matrix E' 



El E3-E2M2 



has rank at most z over F„ since the columns of E' are 



simply linear combinations of columns of E whose rank is at most z. Therefore the problem degenerates 
into a single source problem and sink t can decode Xi with probability at least 1 — \£\/p by following 
the approach in [|8||. 

Summarizing the above decoding scheme for Xi and X2, we have the following main result: 

Theorem 4. Each t can efficiently decode the information from all sources correctly with probability at 
least 1 — |s| 



Decoding complexity: For both coherent and non-coherent cases the computational complexity of 
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Gabidulin encoding and decoding of two source messages is dominated by the decoding of X2, which 
requires 0{nNmsi\og{pnN)) operations over Fp (see (HI). 

To generalize our technique to more sources, consider a network with s sources 61,62, ■■■ ,Ss. Let Ri 
be the rate of Si and Ui = Ri + 2z for each i E [1, s]. A straightforward generalization uses the multiple- 
field-extension technique so that Si uses the generator matrix over finite field of size p"i"2 the end 
the packet length must be at least Ug = nin2 ■ ■ - Us, resulting in a decoding complexity 0{msn'^ \og{png)) 
increasing exponentially in the number of sources s. Thus the multiple field-extension technique works 
in polynomial time only for a fixed number of sources. 

Note that the intermediate nodes work in the base field Fp to perform random linear network coding. 
The multiple-field-extension is an end-to-end technique, i.e., only the sources and sinks use the extended 
field. 

C. Coherent case 

Sections IVTl IVII-Al and IVII-Bl give code constructions for the non-coherent coding scenario. Note that 
a non-coherent coding scheme can also be applied in the coherent setting when the network is known. 
Hence, the capacity regions of coherent and non-coherent network coding for the same multi-source 
multicast network are the same. However, both the constructions of Sections IVII-AI and IVII-BI include 
an overhead of incorporating a global coding vector. Therefore, they achieve the outer bounds given by 
(HI) only asymptotically in packet length. In contrast, in the coherent case, the full capacity region can be 
achieved exactly with packets of finite length, as shown in the following: 

Proof of Theorem^ coherent case achievability: We first construct a multi-source multicast network 
code C for Q that can correct any 2z errors with known locations, called erasures in [25]. We can use 
the result of [26 J for multi- source multicast network coding in an alternative model where on each link 
either an erasure symbol or error-free information is received, by observing the following correspondence 
between the two models. We form a graph Q' by replacing each link I in Q with two links in tandem 
with a new node vi between them, and adding an additional source node u of rate 2z connected by a new 
link ki to each node vi. We use the result from 1261 to obtain a multi-source network code that achieves 
a given rate vector under any pattern of erasure symbols such that the maxflow-mincut conditions are 
satisfied for every subset of sources in Q' . In particular, if erasure symbols (by the definition of (261) are 
received on all but 2z of the new links ki (corresponding to 2z erasures in Q by the definition of [^251), 
all the original sources can be decoded. 
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Let kj,j = 1, . . . , rij, be the outgoing links of each source Si,i = 1, . . . ,n. Next, we construct the 
graph from Q by adding a virtual super source node w, and rii links = 1, . . . , nj, from w to each 
source Sj. Then the code C for the multi- source problem corresponds to a single- source network code Cs 
on Qs where the symbol on each link I'-j is the same as that on link lij, and the coding operations at all 
other nodes are identical for Q^/ and Qs. 

By [l25ll the following are equivalent in the single-source case: 

1) a linear network code has network minimum distance at least 2z + 1 

2) the code corrects any error of weight at most z 

3) the code corrects any erasure of weight at most 2z. 

This implies that Cs has network minimum distance at least 2z + l, and so it can correct any z errors. ■ 

VIII. Extension to more than two sources 

When there are more than two sources the extension of our encoding and decoding techniques is 
straightforward both for the case of the side-channel and the omniscient model, and up to this point we 
have focused on the case of two sources simply for notational convenience. To clarify how our techniques 
can extend to multiple sources we will outline the encoding and decoding for an arbitrary number of 
sources equal to s and use results from the previous sections. 

Side-channel model: For the case of the side-channel model each source encodes its data G ¥^^^^^^°'\ 
z G {1, . . . , s}, in a matrix Mj = Xi where Lj G F^^^^" will be such so that equation Hi = MiPi 
holds. Source Si shares with the receiver/receivers the random matrix Hi G Fi^'^" along with the random 



vector Wi 



Til ri2 



. The vector Wi defines matrix Pi G Fp " since its {m,n) — th entry 
equals (rj„)™. Every receiver follows the decoding steps described in Section |VI] and gets equations 
MiPi = M^{FHi) = Hi, i G that can be solved with high probability using Gaussian 

elimination. 

Omniscient model: For the case of the omniscient adversary we will need to extend the field we work with 
s times. Assume that rii = Ri + 2z and the information from source Si is organized into a matrix Xi G 
^RiXknx...ns _ ggfore transmission matrix Xi, i G {1, . . . , s — 1}, is viewed as matrix Xj G ^^^i^^'^i+^-^s 
in the larger field Fp. where pi = - and Xg is viewed as a matrix X^ G ¥p^'^'^ where ps = 
Each matrix Xj is multiplied with a generator matrix Gi G Fp"'^^% creating G^Xj whose unfolded version 
M- = (GjXj)" is a matrix in jp^ix'^"! AH matrices Gi are chosen as generator matrices for Gabidulin 
codes and have the capability of correcting errors of rank at most z over field Fp-. 
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Source Si create the message matrix Mi by appending some header to M[, specifically the message 



is Ml 



o 



n\ xris 



where /„j is the identity matrix with dimensions rii x rii and 



Oriixrij is the zero matrix with dimensions rii x nj. Similarly M2 



On 



M^ 



M, 



xn2 



Ml 



and therefore the packet length is £ = Yll=i + k YU=i ^« over 



Fp the base field of network coding. 

Similar to equation (fT9l ) the received matrix can be written as 



Y = TiMi + . . . + T,M, + 



n ... n 



+1 



Ti ... T, A' 



where A' = TiM( + ... + T^M^ and S G F^^""^ has rank no more than z over field Fp. For the decoding 



of information from source S. we form the matrix Y' 



YiGi . . . Ys-iGs-i Yg Y^_^_^ 



and transform 



it to a row-reduced echelon form as in Proposition [21 Since matrix D' 



Tg-iGs-i Ts 



IS 



invertible with high probability similar to Lemma [2] one can use Lemma [3] and decode Xg. By subtracting 



Or. 



can solve it recursively. 



OmsXUs-i Ys YgAdg 



from Y the problem reduces to s — 1 number of sources and one 



IX. Comparison of our code constructions 



TABLE II 

Comparison of performance metrics of the code constructions given in Sections [VI1IVII-A1 and IVII-BI for any 

achievable rate vector r2,. . . ,rs) 





decoding complexity 


packet length 


Side-channel model 




0(m^) 


Omniscient adversary: 
subspace codes 




Q{ms) 


Omniscient adversary: 
field extension codes 


0{mg^^ \og{pm%)) 





In this section we compare some performance metrics of the code constructions given in Sec- 
tions |Vll IVII-AI and IVII-BI For convenience, Table |II] summarizes the requirements on the decoding 
complexity and the packet length for each of the achievable schemes. For clarity of comparison, we 
approximate all quantities presented in Table [Hi the exact expressions are derived in the corresponding 
sections. 

Based on Table [III we can make the following observations about the practicality of our constructions: 
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• If the secret channel is available, one should use the side-channel model construction since it not 
only achieves higher rates but also provides lower decoding complexity. 

• Multiple-field extension codes have computational complexity that is polynomial in all network 
parameters, but exponential in the number of sources. Therefore, they are preferable when the number 
of sources is small. 

• Random subspace codes become beneficial compared to multiple-field extension codes as the number 
of sources grows. 

X. Conclusion 

In this work we consider the problem of communicating messages from multiple sources to multiple 
sinks over a network that contains a hidden malicious adversary who observes and attempts to jam 
communication. We consider two models. In the first model, the sources share a small secret (that is 
unknown to the adversary) with the sink(s). In the second model, this resource is unavailable - no 
limitations on the adversary's knowledge are assumed. We prove upper bounds on the set of achievable 
rates in these settings. Since more resources are available to the honest parties in the first model, the rate- 
region corresponding to the upper bounds in the first model is larger than that in the second model. We 
also provide novel algorithms that achieve any point in the rate-regions corresponding to the two models. 
Our codes for the first model have computational complexity that is polynomial in network parameters. For 
the second model we have two algorithms. In our codes based on random subspace design, all sources 
code over the same field, and decoding is based on minimum injection distance. Our codes based on 
multiple-field extension have computational complexity that is polynomial in all network parameters, but 
exponential in the number of sources. 

Our codes are end-to-end and decentralized - each interior node is oblivious to the presence of an 
adversary, and merely performs random linear network coding. They also do not require prior knowledge 
of the network topology or coding operations by any honest party. They work in the presence of a 
computationally unbounded adversary, even one who knows the network topology and coding operations 
and can decide where and how to jam the network on the basis of this information. 

A problem that remains open is that of computationally efficient codes for the omniscient adversarial 
case with a large number of sources. This may require new insights in algebraic code design. 

Besides multi-source multicast, our codes have implications for the much more common scenario of 
multiple unicasts. One class of codes (that is not rate-optimal) for this problem assumes that each sink 
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treats information that it is uninterested in as noise, and decodes and successively cancels such messages 
out. Since the code constructions provided here achieve higher rates than those available in prior work, 
they may aid in non-trivial achievability schemes (though in general still not rate-optimal) for this problem. 
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